Free tool · no signup
Every DNS record for your domain, checked.
A, AAAA, MX, NS, TXT, CNAME, SPF and DMARC in one lookup, with the gaps that let people impersonate your domain flagged automatically.
Why DNS is the first thing an attacker reads
DNS is public by design, and it is the cheapest reconnaissance there is. Before touching your site, an attacker reads your records to learn who hosts your mail, whether you left a staging host resolving, which provider you migrated away from but never cleaned up, and, crucially, whether they can send email as you.
- No SPF record means anyone can send mail claiming to be your domain.
- SPF ending in ~all marks forgeries but still delivers them.
- No DMARC means SPF and DKIM failures carry no consequence.
- A single nameserver is one outage away from your whole domain going dark.
This tool reads all of it in one pass and tells you which of those apply to you, in plain English.
Frequently asked questions
What DNS records should every domain have?
At minimum: an A (or AAAA) record so the site loads, at least two NS records so the domain survives one nameserver failing, and, if the domain sends email, MX, SPF and DMARC records. Missing SPF or DMARC is the single most common reason a small business gets impersonated.
What does "SPF is not enforcing" mean?
An SPF record ending in ~all (softfail) or ?all (neutral) tells receiving servers to accept forged mail anyway, just marked. Only -all is a hard fail. Many domains sit on ~all for years believing they are protected.
Why does DMARC matter if I already have SPF?
SPF and DKIM decide whether a message passes a check. DMARC decides what happens when it fails, and sends you reports. Without DMARC, a failure has no consequence, so the checks are advisory only.
Is looking up DNS records legal?
Yes. DNS is public infrastructure by design; every record returned here is something any mail server or browser on the internet can read. Nothing here touches the target site.
Keep reading
Email Spoofing CheckerA deeper look at SPF, DKIM and DMARC.SSL Certificate CheckerExpiry, issuer and hostname match.Security Headers CheckerGrade your HTTP headers A–F.Manual audit from $49A person tests the application itself.Subdomain finderSee the subdomains attackers can see.Website technology checkerThe CMS, plugins and versions in use.Penetration test cost calculatorEstimate a fair price for your scope.Free tool: SPF Record GeneratorPick your email services and get a valid SPF record, with a check of the 10-lookup limit.Free tool: DMARC Record GeneratorBuild your DMARC policy and follow a safe rollout from monitoring to reject.
See what attackers see, for free
Run the free passive check on your website. No login, no impact on your site, results in seconds.
Ready for the full manual audit? See pricing